Annual Cyber Threat Report 2025-26

The evolution of the cyber threat environment

Attackers steal access not just data

The easiest way into a network is by using stolen or compromised legitimate credentials.

• Stolen usernames, passwords, tokens and sessions are now among the most common pathways into Australian networks.
• Identity fraud remained the most reported cybercrime for individuals over the last five years.
• Compromised accounts and credentials have become one of the top incident categories across government, industry and CI.

Reporting is rising

A 36% increase in cyber security incidents reported to ASD's ACSC over the last five years.

Data breaches have remained steady

• FY2021-22: 7% of all incidents
• FY0205-26: 6% of all incidents

Ransomware remains a persistent and disruptive threat

On average 11% of all incidents since FY2021-22 involved ransomware

• FY2021-22: 135 Ransomware incidents
• FY2025-26: 139 Ransomware incidents

State actors remain a significant threat

State actors continue to target Australian governments and businesses to conduct espionage and gain strategic advantage.

They may also be motivated to maintain options to disrupt essential services during periods of crisis or conflict.

Growing malicious use of AI

Advances in AI are lowering the barrier to entry for malicious cyber actors

• Enabling social engineering
• Creating highly convincing deep fakes and impersonations
• Writing and adapting malicious code faster
• Scanning and exploiting vulnerabilities at scale

A more professional cybercrime ecosystem

Cybercrime is a thriving industry

• Specialised roles (e.g. developers and access brokers)
• Cybercrime-as-a-Service (e.g. tools, kits and infrastructure for hire)
• Efficient money laundering and monetisation networks
• Active forums, markets and communities sharing knowledge and tools

While technologies and tactics will evolve, cyber resilience will remain Australian's strongest defence against an increasingly complex threat environment.

Analysing incidents using the MITRE ATT&CK framework

Image

• Phishing (initial Access): 39%
• Compromise Accounts (Resource Development): 21%
• User Execution (Execution): 17%
• Valid Accounts (Initial Access): 15%
• Social Engineering (Stealth): 13%
• Gather Victim Identity Information (Reconnaissance): 13%
• Exploit Public-Facing Application (Initial Access): 13%
• Network Denial of Service (Impact): 11%
• Phishing for Information (Reconnaissance): 11%
• Acquire Infrastructure (Resource Development): 10%

ASD’s ACSC observed a range of common techniques malicious cyber actors used to exploit vulnerabilities in technology and systems, mapped against the MITRE ATT&CK framework. 

During FY2025–26, there was a notable shift away from reconnaissance techniques and a move towards direct access and execution techniques. Phishing remained the most observed initial access technique, with entities specifically warned to beware of spearphishing links. Interestingly, gathering victim identity information decreased from 30% in FY2024–25 to 13% in FY2025–26.